Application Termination Attempt via Wmic.EXE

Title: Application Termination Attempt via Wmic.EXE
Status: test
Description:Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.
References:
  -https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/
  -https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-11
modified:None
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\WMIC.exe' OriginalFileName:'wmic.exe'   selection_cli:
    CommandLine|contains|all:
      -'call'
      -'terminate'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium